The Stakes of Modern eDiscovery

Legal teams today face a constant balancing act: keeping pace with rapid technology changes while maintaining defensible eDiscovery practices. The explosion of data sources, formats, and storage locations makes legal holds, preservation, and collection more complex than ever. Mistakes can lead to sanctions, spoliation findings, or reputational harm.

Many organizations assume Microsoft Purview, included with Microsoft 365, is sufficient for eDiscovery. In reality, its limitations can create hidden risks and costs. Legal and IT teams must understand these limitations and explore smarter alternatives.

The Limits of Relying Solely on Microsoft Purview

Purview is focused on supporting Microsoft 365, but its architecture was never fully designed to support complex enterprise-level discovery scenarios. Relying on it exclusively creates a number of key challenges:

  1. Cost and Licensing Barriers
    Advanced eDiscovery in Purview requires E5 licensing or equivalent add-ons1 which may be required for every user within your enterprise, even if only a handful of employees are custodians in a matter. This model forces companies to pay for capabilities that go unused across most of the organization. For global enterprises, these recurring licensing costs can easily reach hundreds of thousands of dollars annually, all before any data is even collected.
  2. Performance Bottlenecks
    Purview intentionally throttles data exports to approximately 2GB per hour,2 regardless of network speed or case urgency. In practice, this means even modest-sized collections can take days or weeks to complete. Legal teams often resort to manual workarounds or parallel exports, increasing both risk and administrative overhead. In addition to the speed limitations, there are also constraints on the total item count and file sizes of these exports. In this instance, if the export is larger than these limits, it must be split into multiple files and concatenated later.
  3. Search Fidelity and Defensibility
    In eDiscovery, search fidelity means precision, transparency, and repeatability — all necessary to prove that search results are complete and defensible in court. Microsoft outlines indexing limits such as a maximum file size of 150 MB, extraction up to 10 million characters per file, and embedded-item depth up to 253. These limitations can return inconsistent or incomplete results. Without detailed audit logs or standardized reporting, it becomes difficult to demonstrate to opposing counsel or the court that all relevant data was collected and reviewed. Courts have even noted that Microsoft 365’s built-in eDiscovery tools may not enable reliable or repeatable searches compared with full-index platforms.4
  4. Data Governance and Remediation Gaps
    Purview’s architecture offers limited flexibility for managing and segmenting stored data. Once data enters the environment, there’s no straightforward way to isolate or remediate legacy or nonessential content.5 As a result, organizations end up storing vast amounts of redundant, obsolete, and trivial (ROT) data indefinitely. This not only inflates risk during discovery but also drives long-term compliance and storage costs.
  5. Technical and File-Type Limitations
    Purview focuses on Microsoft 365 content — Outlook, Teams, SharePoint, and OneDrive — but enterprise data extends far beyond those sources. Non-Microsoft systems, third-party collaboration tools, and legacy archives often fall outside its reach. Even within M365, practitioners report that Purview indexes less than 100 file types.6 Large attachments, non-standard formats, and inactive mailboxes (e.g., departed employees, unmonitored data stores) often go unindexed. Search restrictions limit the number of concurrent queries, which slows large-scale matters and investigations.
  6. Security and Scripting Vulnerabilities
    Microsoft is retiring older PowerShell modules in favor of the Graph API and PowerShell SDK, but many eDiscovery workflows still rely on legacy scripts. These can expose sensitive credentials, use outdated authentication, or require excessive privileges. Even with new Graph-based methods, gaps remain – such as limited auditing, complex permissions, and potential disruption for teams still dependent on deprecated automation.
  7. Inactive Mailbox Visibility
    Purview provides limited visibility into inactive or departed employee mailboxes. The portal caps the display at 5,000 inactive mailboxes, meaning larger organizations cannot easily review or manage all inactive accounts through the UI.7 While Microsoft Graph API enables secure, modern access and better auditing compared with legacy PowerShell workflows, it does not remove the underlying challenge of managing historical mailboxes. Legal and IT teams still need careful processes to locate, preserve, and collect data from departed employees without delays or gaps.
  8. Preservation of Hyperlinked Files
    Purview can struggle to preserve and collect hyperlinked content stored in SharePoint, OneDrive, or Teams.8 Many modern Microsoft 365 documents contain links to other files rather than embedded content. During collection, these links may not resolve correctly or could point to files that have been removed, renamed, or deleted, leaving gaps in the preserved record. For example, a financial report linking to supporting spreadsheets may be collected without the linked data, creating defensibility risks and potentially incomplete evidence in litigation or regulatory matters.
The Risks When Built-In Tools Fall Short

Depending on Purview alone can expose organizations to:

Distributed Micro-Indexing In-Place: A Better Way

Many organizations adopt Microsoft Purview expecting seamless, enterprise-wide eDiscovery, providing fast, accurate search across data sources with minimal disruption and defensible results. The reality is there are certain performance, licensing, and coverage limitations that affect outcomes. Distributed micro-indexing in-place provides a smarter path forward with speed, scalability, and defensibility across all data sources, not just M365.

What It Is

Instead of creating one giant index or mass-exporting data, this model creates lightweight indexes for each custodial and non-custodial data source. It allows real-time search and collection at the source — across email, endpoints, cloud repositories, inactive mailboxes, and archives — without disruption or massive exports.

Core Benefits

  • Search and Collect Only What’s Relevant: Instead of exporting entire repositories, legal teams can defensibly search, cull, and collect just the data that matters. Micro-indexing preserves all family relationships — attached, embedded, and hyperlinked — ensuring that documents, supporting files, and linked content remain intact for defensible collection.
  • True Speed and Scalability: Micro-indexing avoids throttling issues and delays. Organizations can process thousands of custodians or devices in hours, instead of weeks. This scalability also supports global enterprises, with data spread across multiple geographies or cloud platforms.
  • Security and Defensibility: Collections are performed without high-privilege exports or mass data transfers, minimizing the risk of credential exposure or accidental data leakage. Every action is logged and auditable, creating a transparent chain of custody for regulatory compliance or litigation defense.
  • Lower Total Cost of Ownership: Organizations avoid premium licensing traps and unnecessary storage costs. Because only targeted data is collected, less data moves downstream to expensive review stages. Legal teams also save time and resources by reducing the administrative overhead of managing massive, unwieldy data sets.
  • Proactive Governance and Disposition: Distributed micro-indexing solutions support ongoing data remediation by identifying ROT data before litigation arises. This proactive capability not only reduces the eDiscovery footprint in future matters but also helps organizations maintain compliance with retention policies and lower long-term storage costs.

Buyer Beware

Not all “index-in-place” tools are created equal. Some still rely on mass copying or staging, recreating the bottlenecks that modern eDiscovery professionals are trying to avoid. True distributed micro-indexing means no bulk data transfer, no monolithic indexing, and no hidden licensing traps.

How Prism Delivers Enterprise-Grade eDiscovery

At Prism, we help organizations move beyond the limits of Purview with enterprise-ready strategies and technology.

  • Trusted Advisor: We deliver innovative solutions across the eDiscovery lifecycle to reduce data volumes, provide actionable metrics, and help case teams locate key evidence quickly.
  • True Index-in-Place Expertise: Our team incorporates best-in-class distributed micro-indexing solutions to rapidly assess and collect targeted data — without hidden traps or licensing pitfalls.
  • Defensible Disposition Planning: The battle against data volumes doesn’t end at production. Our workflows include defensible disposition plans to remediate ROT data proactively, reducing your eDiscovery “haystack” before litigation arises.
Conclusion: Realizing the Promise of Enterprise eDiscovery

Microsoft Purview provides a baseline, but it cannot meet the full scope of today’s eDiscovery and information governance demands. With Prism’s expertise and advanced technology partnerships, organizations can overcome limitations, reduce costs, and achieve defensible, scalable results.

Ready to move beyond the limits of Purview?

Contact Prism Litigation Technology [link] to discuss a tailored approach to your eDiscovery challenges.

_____________________________________________

1 Microsoft 365 licensing requirements for eDiscovery — See “Want to try premium eDiscovery features? See the subscription requirements for Microsoft 365 Enterprise E5 licensing.” Limits in eDiscovery | Microsoft Learn
2 Export and throughput limits: “Rate at which content from mailboxes are exported 2 GB per hour per mailbox.” Limits in eDiscovery | Microsoft Learn
3 Indexing limits: “Maximum size of a single file 150 MB, maximum depth of embedded items 25, maximum advanced indexing throughput 2 GB per hour.” eDiscovery (Premium) limits | Microsoft Learn
4 Deal Genius, LLC v. O2Cool, LLC, No. 21-cv-6114 (N.D. Ill. Mar. 4, 2024), Special Master Order ¶
5 Practical Law The Journal, “Microsoft Purview eDiscovery: Features and Limitations,” Thomson Reuters, Aug. 2024.
6 The Good, The Bad and The Way Forward: What You Need to Know About eDiscovery with Microsoft 365 | Veritas
7 Create and manage inactive mailboxes | Microsoft Learn
8 Microsoft Purview eDiscovery: Key Features and Limitations – Innovative Driven